HTTP proxy

The generic HTTP proxy is exposed at /HttpProxy in builds that include the service. It lets an authenticated client retrieve a target through the Neuron, useful when the client platform cannot access an HTTP-only resource or when egress must use the Neuron’s network and client certificate.

​

Authentication

The resource can accept:

• normal HTTP authentication;
• a logged-in web session;
• JWT bearer token;
• mutual TLS when enabled.

An XMPP client can obtain a Neuron JWT through the HTTP-over-XMPP extension and use it for protected HTTP resources.

​

Use safely

An unrestricted proxy can become an SSRF and abuse service. Configure:

• allowed schemes, hosts, ports, and methods;
• blocks for loopback, link-local, private, and cloud-metadata addresses;
• redirect validation at every hop;
• request/response size and time limits;
• removal of caller credentials on cross-origin redirect;
• role and WAF restrictions;
• audit events containing actor, destination, method, and result.

​

Choose between proxy options

If a client can securely reach the target directly, a proxy adds operational and security cost without benefit.